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. Abstract 

Os . 

Coin flipping is a fundamental cryptographic primitive that enables two distrustful and 
(— I , far apart parties to create a uniformly random bit |Blu81| . Quantum information allows for 

^ ^' protocols in the information theoretic setting where no dishonest party can perfectly cheat. 

I K , The previously best-known quantum protocol by Ambainis achieved a cheating probability of 

^ ■ at most 3/4 |Amb01| . On the other hand, Kitaev showed that no quantum protocol can have 

cheating probability less than 1 / |Kit03| . Closing this gap has been one of the important 
open questions in quantum cryptography. 

In this paper, we resolve this question by presenting a quantum strong coin flipping protocol 
with cheating probability arbitrarily close to 1/V2. More precisely, we show how to use any 
I weak coin flipping protocol with cheating probability 1/2 + e in order to achieve a strong coin 

I ' flipping protocol with cheating probability 1/^/2 + 0{e). The optimal quantum strong coin 

^-H i flipping protocol follows from our construction and the optimal quantum weak coin flipping 

lO ' protocol described by Mochon |Moc07| . 

O ■ 1 Introduction 

o^ : 

^ I Coin flipping is a cryptographic primitive that enables two distrustful and far apart parties, Alice 

^ ■ and Bob, to create a random bit that remains unbiased even if one of the players tries to force a spe- 

^ , cific outcome. It was first proposed by Blum |Blu81] and has since found numerous applications in 

^ I two-party secure computation. In the classical world, coin flipping is possible under computational 

■ - - ' assumptions like the hardness of factoring or the discrete log problem. However, in the information 

theoretic setting, it is not hard to see that in any classical protocol, one of the players can always 
bias the coin to his or her desired outcome with probability 1. 

Quantum information has given us the opportunity to revisit information theoretic security in 
cryptography. The first breakthrough result was a protocol of Bennett and Brassard |BB84j that 
showed how to securely distribute a secret key between two players in the presence of an omnipo- 
tent eavesdropper. Thenceforth, a long series of work has focused on which other cryptographic 
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primitives are possible with the help of quantum information. Unfortunately, the subsequent re- 
sults were not positive. Mayers and Lo, Chau proved the impossibility of secure quantum bit 
commitment and oblivious transfer and consequently of any type of two-party secure computa- 
tion |May97[ ILC971 IDKSW07] . However, several weaker variants of these primitives have been 
shown to be possible |HK04l IBCH+OS] . 

The case of coin flipping is one of the most intriguing ones. Even though the results of Mayers 
and of Lo and Chau exclude the possibility of perfect quantum coin flipping, i.e. where the resulting 
coin is perfectly unbiased, it still remained open whether one can construct a quantum protocol 
where no player could bias the coin with probability 1. A few years later, Aharonov et al. [ATVYOO] 
provided such a protocol where no dishonest player could bias the coin with probability higher than 
0.9143. Then, Ambainis [AmbOlj described an improved protocol whose cheating probability was 
at most 3/4. Subsequently, a number of different protocols have been proposed [SROU [NS031 IKN04] 
that achieved the same bound of 3/4. 

On the other hand, Kitaev [Kit03] . using a formulation of quantum coin flipping protocols as 
semi-definite programs proved a lower bound of 1/2 on the product of the two cheating probabilities 
for Alice and Bob (for a proof see e.g. |ABDR04] ) . In other words, no quantum coin flipping 
protocol can achieve a cheating probability less than 1 / \/2 for both Alice and Bob. 

The question of whether 3/4 or l/-\/2 is ultimately the right bound for quantum coin flipping 
has been open since then. In fact, there had been "evidence" suggesting both cases. First, Kitaev's 
semi-definite program formulation of coin flipping seems to be a natural one and using this semi- 
definite program one cannot hope to prove a better lower bound. On the other hand, most of the 
suggested coin flipping protocols were using some form of imperfect bit commitment scheme. More 
precisely, Alice would quantumly commit to a bit a, Bob would announce a bit b and then Alice 
would reveal her bit a. The outcome of the coin flip would be a ©6. However, Ambainis had proved 
a lower bound of 3/4 for any protocol of this type and even though more complicated protocols 
based on similar ideas had been proposed, they all seemed to get stuck at the same 3/4 bound. 

During the study of quantum coin flipping, a weaker variant was introduced that is referred 
to as weak coin flipping in opposition to the original strong coin flipping. In this setting, Alice 
and Bob have a priori a desired coin outcome, in other words the two values of the coin can be 
thought of as 'Alice wins' and 'Bob wins'. We are again interested in bounding the probability that 
a dishonest player can win this game. 

Weak coin flipping protocols with cheating probabilities less than 3/4 were constructed in |SR02[ 
IAmb02[[KN04] . The best achieved bound was in fact l/\/2, a strange coincidence, since Kitaev's 
lower bound of 1/V2 does not apply in the case of weak coin flipping. The only lower bound 
that carries over from the case of strong coin flipping is a bound by Ambainis that shows that 
in order to achieve a cheating probability of 1/2 + e the protocol must have at least O (log log ^) 
rounds |Amb02j . We refer to e as the bias of the protocol. 

Finally, a breakthrough result by Mochon resolved the question of the optimal quantum weak 
coin flipping. First, he described a protocol with cheating probability 2/3 |Moc041 IMocOSj and 
then a protocol that achieves a cheating probability of 1/2 + e for any e > |Moc07] . Kitaev's 
formalism and Mochon's optimal weak coin flipping protocol delve heavily into the theory of convex 
cones and operator monotone functions. 

In this work, we resolve the question of the optimal quantum strong coin flipping protocol. We 
present a general method on how to use any weak coin-flipping protocol with cheating probability 
1/2 + e in order to construct a strong coin- flipping protocol with cheating probability l/^/2 + 0{e). 
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Our protocol uses roughly the same number of rounds as the weak coin flipping protocol. Combining 
our construction with Mochon's quantum weak coin flipping protocol that achieves arbitrarily small 
bias, we conclude that it is possible to construct a quantum strong coin flipping protocol with 
cheating probability arbitrarily close to 

Let us make a few remarks about our protocol. First, it is a classical protocol that uses a 
weak coin flipping as a subroutine. In other words, in coin flipping, the power of quantum really 
comes from the ability to perform weak coin flipping. If there existed a classical weak coin flipping 
protocol with arbitrarily small bias, then this would have implied a classical strong coin flipping 
protocol with cheating probability arbitrarily close to l/\/2 as well. Moreover, our protocol has 
the advantages of being very easy to describe and having a straightforward analysis, assuming, of 
course, the existence of a weak coin flipping protocol. 

Using weak coin flipping in order to perform strong coin flipping is not a new idea. There 
is a trivial protocol that uses a perfect weak coin flipping and achieves strong coin flipping with 
cheating probability 3/4: Alice and Bob run the weak coin flipping protocol and whoever wins, 
flips a random coin c G_r {0, 1}. 

Our protocol can be thought of as a refinement of the abovementioned one. There are two simple 
ideas that we use. First, we will have Alice flip and announce the outcome of her random coin 
before Alice and Bob perform the weak coin flipping protocol. Second, we will use an "unbalanced" 
weak coin flipping, where in the honest case, Alice wins with probability z and Bob with probability 
1-z. 

We can now describe informally our protocol 



Strong Coin Flipping Protocol 

• Alice flips a random coin a and sends a to Bob. 

• Alice and Bob run an unbalanced weak coin flipping protocol where honest Alice wins 
with probability z and honest Bob with probability 1 — z. 

• If Alice wins, the output is a. 

• If Bob wins, he outputs a with probability p and a with probability 1 — p. 



In Section HI we first show how to construct "unbalanced" weak coin flipping protocols for any 
z and bias 0(e), assuming the existence of a "balanced" weak coin flipping protocol with bias e. 
Then, we optimize the parameters z and p in order to make the cheating probability of our protocol 
at most l/V2 + 0{e). 

2 Definitions 

We provide the formal definitions of all the different variants of coin flipping protocols that we are 
going to use. 

A coin flipping protocol between two parties Alice and Bob is a protocol where Alice and 
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Bob interact and at the end, Alice outputs a value ca G {0,1, Abort} and Bob outputs a value 
cb G {0,1, Abort}. If CA = cb, we say that the protocol outputs c = ca- If ca / cb then the 
protocol outputs c = Abort. 

In a coin flipping protocol, we call a round of communication one message from Alice to Bob 
and one message from Bob to Alice. We suppose that Alice always sends the first message and Bob 
always sends the last message. The protocol is quantum if we allow the parties to send quantum 
messages and perform quantum operations. A player is honest if he or she follows the protocol. A 
cheating player can deviate arbitrarily from the protocol but still outputs a value at the end of it. 
There are two important variants of coin flipping that have been studied. 

Weak coin flipping 

A (balanced) weak coin flipping protocol with bias e {WCF{l/2,£)) has the following properties 

• If c = 0, we say that Alice wins. If c = 1, we say that Bob wins. 

• If Alice and Bob are honest then Pr [ Alice wins ] = Pr [ Bob wins ] = 1/2 

• If Alice cheats and Bob is honest then = Pr [ Alice wins ] < 1/2 + e 

• If Bob cheats and Alice is honest then = Pr [ Bob wins ] < 1/2 + e 

The probabilities and are called the cheating probabilities of Alice and Bob respectively. 
The cheating probability of the protocol is defined as max{P^, -Pg}. We say that the coin flipping 
is perfect if e = 0. 

We can also define weak coin flipping for the case where the winning probabilities of the two 
players in the honest case are not equal. 

Unbalanced weak coin flipping 

A weak coin flipping protocol with parameter z and bias e {WCF(z,e)) has the following prop- 
erties. 

• If c = 0, we say that Alice wins. If c = 1, we say that Bob wins. 

• If Alice and Bob are honest then Pr [ Alice wins ] = z and Pr [ Bob wins ] = 1 — z 

• If Alice cheats and Bob is honest then P^ = Pr [ Alice wins ] < z + e 

• If Bob cheats and Alice is honest then P^ = Pr [ Bob wins ] < {1 — z) + £ 

Strong coin flipping 

A strong coin flipping protocol with bias e {SCF{e)) has the following properties 

• If Alice and Bob are honest then Pr [c = 0] = Pr [c = 1] = 1/2 

• If Alice cheats and Bob is honest then P^ = max{Pr [c = 0] , Pr [c = 1]} < 1/2 + e. 

• If Bob cheats and Alice is honest then = max{Pr [c = 0] , Pr [c = 1]} < 1/2 + e 

Similarly, P^ and P^ are the cheating probabilities of Alice and Bob. The cheating probability of 
the protocol is defined as max{P^,P^}. 

We will also use the following result by Mochon 

Proposition 1 (Moc07] For every e > 0, there exists a quantum WCF{l/2,£) protocol P. 
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3 An optimal strong coin flipping protocol 



In this section, we describe how to construct an optimal strong coin flipping protocol from any 
weak coin flipping protocol. Let us try to give some intuition for our protocol before we actually 

describe and analyze it. For this high level discussion, we assume the existence of a perfect weak 
coin flipping protocol. As we said, there exists a trivial protocol that uses a weak coin flipping in 
order to achieve strong coin flipping: 

SCF(3/4) protocol using a perfect weak coin flipping protocol P 

• Alice and Bob run the protocol P 

• The winner chooses a random c {0, 1}, and sends c to the other player, c being the outcome 
of the protocol. 

Let us analyze this protocol more closely. Let Alice be dishonest and her desired value for the 
coin be 0. Her strategy will be to try and win the WCF protocol, which happens with probability 
1/2 and then output 0. However, even if she loses the weak coin flipping, there is still a probability 
1/2 that the honest Bob will output 0. Hence, Alice's (and by symmetry Bob's) cheating probability 
is 3/4. 

In order to reduce this bias, we would like to eliminate the situation where the honest player, 
after winning the WCF, still helps the dishonest player cheat with probability 1/2. One can try 

to resolve this problem by having Alice flip and announce her random coin c before running the 
WCF protocol. In this case: first, Alice announces a bit a. Then, Alice and Bob perform a WCF. 
If Alice wins the outcome is a; if Bob wins then the outcome is a. 

In this case, Bob never outputs a. However, there is a simple cheating strategy for Alice. If she 
wants 0, she sets a = 1, loses the WCF (which she can do with probability 1) and therefore Bob 
always outputs 0. Hence, Bob's choice when he wins the WCF must be probabilistic. Let us now 
consider the following protocol: 

Improved SCF protocol using a perfect weak coin flipping protocol P 

• Alice picks a random bit a {0, 1} and sends a to Bob. 

• Alice and Bob run P. 

• If Alice wins then the outcome is a. 

• If Bob wins then he outputs a with probability p and a with probability 1 — p. 

First note that Bob's cheating probability is 3/4, independent of p. Namely, if Alice picks the 

value Bob wants, then he just loses the WCF; if Alice picks the opposite value then he tries to win 
the WCF in order to pick his desired value. On the other hand, let us calculate Alice's cheating 
probability. Alice can pick a to be equal to her desired outcome, in which case the final outcome 
is a with probability ^ ■ 1 + ^ ■ p. She may also pick a to be the opposite of her desired outcome, 
in which case she always loses the WCF and hence, the final outcome is a with probability I — p. 
Alice's cheating probability is the maximum of the two cases. By choosing p = 1/3 the probabilities 
in the two cases are equal and we conclude that Alice's cheating probability is 2/3. 
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Hence, using any balanced WCF protocol, we can have a strong coin flipping protocol that 
achieves cheating probability 3/4 for Bob and 2/3 for Alice. This in some sense already beats the 
best previously known protocol that can only achieve cheating probability 3/4 for both Alice and 
Bob. 

Our next step is to make these two cheating probabilities equal. For this, we will use an 
unbalanced WCF with parameter z and optimize z and p in order to get the optimal bound of 
1/V2. 

We can now describe our final protocol that uses a WCF{z, e) protocol Q as a subroutine. 



Strong Coin Flipping protocol S 

1. Alice chooses a {0, 1} and sends a to Bob. 

2. AHce and Bob perform the WCF{z, e) protocol Q 

• If Alice wins Q then honest players output ca = cb = a 

• If Bob wins Q then he flips a coin b such that b = a with probability p and b = a 
with probability (1 — p). He sends b to Alice. In this case, honest players output 
CA=CB = b. 

• If Q outputs Abort then Abort 



4 Analysis of the strong coin flipping protocol S 

We first describe the construction of the unbalanced WCF{z,e) protocol and then show how to 
optimize the parameters z and p in order to achieve the optimal bias. 

4.1 An unbalanced weak coin flipping protocol 

Our goal is to prove the following proposition 

Proposition 2 Let P be a WCF{l/2,£) protocol with N rounds. Then, Mz e [0, 1] and Mk e N, 
there exists a WCF{x,So) protocol Q such that: 

• Q uses k ■ N rounds. 

• \x — z\ < 2~^. 

• Eq < 1e. 

The protocol Q is a sequential composition of the WCF{l/2,s) protocol P. In high level, we 
use P in order to combine two weak coin flipping protocols with parameters zi and Z2 into a new 
protocol with parameter Then, by recursion, for any given z we can create a protocol Q 

with parameter x that rapidly converges to z. We also prove that the bias of Q is at most 2e. 
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Assume we have a WCF{zi,eo) protocol Pi and a WCF{z2,£o) protocol P2 each with at most 
M rounds of communication and Z2 > zi. We combine them in the following way. 

Comb(Pi,P2) 

• Alice and Bob run P. 

• If Alice wins, run P2. If Bob wins, run Pi. If P Aborts then Abort. 



Note that this protocol uses at most N + M rounds. We have 
Lemma 1 Com6(Pi, P2) is a WCF{^^^,eQ + £(2:2 - zi)) protocol. 
Proof: 

Alice and Bob are honest If Alice and Bob are honest then the protocol never aborts. We have 
Pr[ Alice wins ] = and Pr[ Bob wins ] = 1 - 

Alice cheats and Bob is honest Let x = Pr [Alice wins P] ; y = Pr[Bob wins P]; ti = Pr [Alice 
wins P2 I Alice wins P]; u = Pr [Alice wins Pi | Bob wins P]. We know the following inequalities 
concerning these probabilities: 

X + y <l X <l/2 + £ u < Z2 + £0 V < zi + £0 

Note that the last two inequalities hold, since the biases for the protocols Pi and P2 do not 
increase depending on the outcome of P. We have 

Pr [ Alice wins Com6(Pi, P2)] 

= x-u + y-v < x{z2 + £0) + i'i- — x){zi + £0) = {zi + £0) + x{z2 — Zl) 

< {zi + £0) + {1/2 + £){z2 — zi) since Z2 > 2^1 

< ^ \- £0 + £{Z2 - Zl) 

Bob cheats and Alice is honest Using a similar calculation as in the previous case, we have 
Pr[Bob wins Com6(Pi, P2)] < ^ ^ ^^^^ _ = 1 _ zi±z2 + ^ ^(^^^ _ g 

We now show the following inductive Lemma 

Lemma 2 Suppose we have a WCF{l/2,£) protocol P that uses N rounds of communication. 
Then Vz G [0,1] and VA; G N, we can construct a WCF{xi,£o) protocol Pi and a WCF{x2,£o) 
protocol P2 such that 

• Pi , P2 each use at most k ■ N rounds. 

• xi < z < X2 and X2 — xi = 2~^. 

• £0 < (2 - 2{X2 - Xi))£. 
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Proof: Fix z G [0,1]. We show this result by induction on k. For A; = 0, we clearly have a 
VFC-F(0, 0) protocol (a protocol where Bob always wins) and a WCF{\^ 0) (a protocol where Alice 
always wins) that use no rounds of communication. We suppose the Lemma is true for k and we 
show it for A; + 1. 

Let xi, rE2, Pi, -P21 eo that satisfy the above properties for k. Let P' be the Conib{Pi, P2) protocol 
and u = ^li^. P' uses at most {k + 1)A^ rounds and from Lemma [H we know that P' is a 
WCF{u,e'Q = eo + (2^2 — 3^i)e) protocol. From the induction step we have that s'q < (2 — 2{x2 — 
xi))e + (x2 — xi)e < {2 — (x2 — xi))e. We now distinguish two cases 

• If 2; < u, consider the protocols Pi and P'. Each one uses at most (k + 1)A^ rounds. Also, 
xi <z <uandu-xi = ^^^^ = 2'^''+'^^ Finally, ^ < (2 - (x2 - xi))e = (2 - 2{u - xi))£ 
which concludes the proof. 

• If z > u, consider the protocols P' and P2. Each one uses at most (k + 1)A^ rounds. Also, 
M < z < X2 and X2 - M = = 2-^''+'^\ Finally, e'q < (2 - (x2 - xi))e = (2 - 2(x2 - u))e 
which concludes the proof. 

■ 

In Lemma O we have \xi — z\ < {x2 — xi) < 2~^ and Eq < 2e. Hence this Lemma directly 
implies Proposition [2] by considering Q = Pi. 

4.2 Strong coin flipping from unbalanced weak coin flipping 

We calculate the cheating probability of our protocol S that uses a WCF{z,£) protocol Q. 

Proposition 3 The protocol S is a strong coin flipping protocol with N + 2 rounds of communica- 
tion and cheating probabilities P^ < 2-\-£ ^''^^ — ^~2^^ • 

Proof: 

Alice and Bob are honest If both players are honest then they never abort. Moreover, since the 
protocol is symmetric in and 1, we have Pr [c = 0] = Pr [c = 1] = 1/2. 

Alice cheats and Bob is honest We prove that Pr [c = 0] < 2-z-e • symmetry, the same 
holds for Pr [c = 1]. Since Alice cheats, she can choose arbitrarily between a = and a = 1 instead 
of picking a uniformly at random. Hence, Pr[c = 0] < maxjPr [c = 0|a = 0] , Pr [c = 0\a = 1]}. 

• We first calculate Pr [c = 0|a = 0]. 

Let X = Fr [Alice wins Q\a = 0] and y = Pr [Bob wins Q\a = 0]. We have Pr [c = 0|a = 0] = 
X ■ 1 + y ■ p. Note that x + y < 1 and also x < z + e, since the maximum bias with which Alice 
can win Q is independent of the value of a. We have 

Pr[c = 0|a = 0] = x-l + y-p < x + {1 — x)p = p + x{l — p) 
< p+{z + £){l-p) 

• We now calculate Pr [c = 0|a = 1]. 

Let x = Pr [Alice wins Q\a = 1] and y = Pr [Bob wins Q\a = 1]. We have 

Pr [c = 0|a = 1] = X • + y(l — p) < y{l — p) < 1 — p 
which is achievable since Alice could always let Bob win Q. 
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Since Pr [c = 0] < maxjPr [c = 0|a = 0] , Pr [c = 0|a = 1]}, we choose p such that the upper bounds 
for Pr [c = 0|a = 0] and Pr [c = 0|a = 1] are equal. 

p + {z + e){l - p) = 1 - p 

1 — z — s 

P = 7, 

2 — z — e 

With this value of p, we have 

Pr[c=0] < max{Pr[c = 0|a = 0],Pr[c = 0|a= 1]} = 1-p < ^ 



2- z-e 

Since the protocol is symmetric in and 1, we also have Pr [c = 1] < and hence P\ < 

Bob cheats and Alice is honest We prove that Pr [c = 0] < . By symmetry, the same holds 

for Pr [c = 1]. Alice is honest and picks a uniformly at random. We first have Pr [c = 0|a = 0] < 1. 
We now upper bound Pr [c = 0|a = 1]. Let x = Pr [Bob wins Q\a = 1] and y = Pr [Alice wins Q\a = 1]. 
We have 

Pr[c = 0|a = l]<2;-l+y-0<x<l-2: + e 
Since Alice is honest, we have Pr [a = 0] = Pr [a = 1] = 1/2 and hence: 

Pr[c = 0] = Pr[c = 0|a = 0] •Pr[a = 0] +Pr[c = 0|a = 1] •Pr[a = 1] 
= - (Pr [c = 0|a = 0] +Pr [c = 0|a = 1]) 

< l^l^lll 
- 2 2 

2- z + e 



Since the protocol is symmetric in and 1, we also have Pr [c = 1] < ^ and hence < ^ 



4.3 Putting it all together 

To conclude, we have to optimize z. In the case where there exists an ideal weak coin flipping 
protocol WCF{1/2,Q), it is easy to see that in order to equalize the cheating probabilities P\ and 
P^, we need to take z = 2 — \f2. If also our Proposition [2] was ideal, i.e. if from P we could create 
perfectly a WCF{2 — ^/2, 0) protocol Q, then S would have cheating probability exactly 

In general, we need to take care of the small bias e of the initial WCF(l/2,e) protocol P 
and the error of our Proposition [2j However, we will see that the overall increase in the cheating 
probability of our protocol S is only 0{e). 

Theorem 1 // there exists a WCF(l/2,e) protocol P that uses N rounds of communication then 
there exists a strong coin flipping protocol S that uses 2[log(^)] ■ N + 2 rounds with cheating 
probability at most -j= + y/2e + o(e) . 
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Proof: Starting from the WCF(l/2,e) weak coin flipping protocol P with rounds, we can 
use Proposition [2] with k = 2[log(^)] and construct a WCF{x,e') protocol Q with the following 
properties 

• Q uses 2[log(i)] • N rounds. 

• |x- (2-^2)1 <e^. 

• e' < 2e. 

Then, we use the protocol Q in the strong coin flipping protocol S we described in Section [3] 
and by Proposition [3] we have that S has 2[log(^)] • + 2 rounds and 



n 



1 1 ^ / X 

< ^ < ^ + V2e + o(e) 



2-x-e' ^ _ 2e - £2 ^ 

1 

72 



2-x + e' V2 + 2e + e^ 1 
Pb = 7, < ^ = +£ + o{e) 



Using Theorem [T] and Mochon's weak coin flipping protocol (Proposition [T]) we conclude that 
Corollary 1 For any e > 0, there exists a strong coin flipping protocol with cheating probability 

Last, note that our strong coin flipping protocol uses 0{N ■ log(^)) rounds, where is the 
number of rounds of Mochon's weak coin flipping protocol. 

5 Conclusion 

In this paper, we presented the first quantum strong coin fiipping protocol with a cheating prob- 
ability arbitrarily close to the optimal value -n=. Our protocol uses as a subroutine the quantum 

v2 

weak coin fiipping protocol designed by Mochon which is arbitrarily close to optimal. Note that 
except when using this quantum weak coin fiipping protocol, our entire protocol is classical. 

We would like to note that Mochon's protocol is still not very well understood (protocol's 
unitary description, number of rounds). It is important to get a better understanding of that 
protocol and/or find a simpler construction of an optimal quantum weak coin fiipping protocol. 
Moreover, it would be interesting to study what other cryptographic primitives can be derived from 
weak or strong coin fiipping. 
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